privateloader | c91b1f6d29e8d33385706fbf3968a84f7aa53d4d05743d16bf59ac10ef04f90a | Triage

Sharing

General

Target

c91b1f6d29e8d33385706fbf3968a84f7aa53d4d05743d16bf59ac10ef04f90a
Size

1.5MB
Sample

231126-rbckgahg66
MD5

3b1d82c21229983fcfa9208d447c3fad
SHA1

adaa263b3c67a6c874a3de76f29450e7b82e8774
SHA256

c91b1f6d29e8d33385706fbf3968a84f7aa53d4d05743d16bf59ac10ef04f90a
SHA512

877d96ec4041b4cf80fe5502fd4666df9252001a65d4abbcd297f104c757d8ca1401ce94154c5cca9b49e7583d7bade8b3988a429ea6c9e357078835a2021216
SSDEEP

24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy

Score

10^/10

privateloader risepro persistence

Malware Config

Extracted

Family

risepro

C2

194.49.94.152

Targets

- Target
  
  c91b1f6d29e8d33385706fbf3968a84f7aa53d4d05743d16bf59ac10ef04f90a
- Size
  
  1.5MB
- MD5
  
  3b1d82c21229983fcfa9208d447c3fad
- SHA1
  
  adaa263b3c67a6c874a3de76f29450e7b82e8774
- SHA256
  
  c91b1f6d29e8d33385706fbf3968a84f7aa53d4d05743d16bf59ac10ef04f90a
- SHA512
  
  877d96ec4041b4cf80fe5502fd4666df9252001a65d4abbcd297f104c757d8ca1401ce94154c5cca9b49e7583d7bade8b3988a429ea6c9e357078835a2021216
- SSDEEP
  
  24576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTy
Score

7^/10

persistence
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

privateloaderrisepro

behavioral1